Founders wanted answers from the database without waiting for a developer

Small teams want to ask their own data questions. The usual fix, letting a model write SQL and running it, hands the model a loaded gun.

The team needed the convenience without the possibility of a dropped table, a leaked phone number, or a runaway query.

• ✦A natural-language-to-SQL step that sees only an allowlisted schema description.
• ✦A safety layer that parses the generated SQL into an abstract syntax tree with sqlglot and enforces: exactly one statement, a plain SELECT, no CTEs, unions, writes or DDL, no bare SELECT *, only allowlisted tables and columns, and a LIMIT capped at a maximum.
• ✦A column allowlist that deliberately excludes phone, email, exact address, PAN and licence numbers, buyer contact details and the embedding vector. The leads table is left out entirely.
• ✦Rejecting a few valid-but-exotic queries on purpose, in exchange for a small attack surface the team can reason about.

• ✦Question goes to the model with the schema allowlist. The SQL that comes back never runs directly.
• ✦The validator either rewrites the query with a safe LIMIT or rejects it with a reason the admin can read.
• ✦Only then does it run, read-only, and the result is rendered as a table with the SQL shown for transparency.